move the socket ```sh mv /var/run/docker.sock /var/run/docker.sock.original ``` redirect all socket communications to a tcp listener in port 1234 ```sh socat TCP-LISTEN:1234,reuseaddr,fork UNIX-CONNECT:/var/run/docker.sock.original ``` create a new proxy socket to be use by the application ```sh socat UNIX-LISTEN:/var/run/docker.sock,fork TCP-CONNECT:127.0.0.1:1234 ``` sniff the traffic ```sh tcpdump -i lo -netvv port 1234